Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 98a2017c authored by Takashi Iwai's avatar Takashi Iwai Committed by Greg Kroah-Hartman
Browse files

ALSA: seq: Fix potential concurrent access to the deleted pool 



commit 75545304eba6a3d282f923b96a466dc25a81e359 upstream.

The input pool of a client might be deleted via the resize ioctl, the
the access to it should be covered by the proper locks.  Currently the
only missing place is the call in snd_seq_ioctl_get_client_pool(), and
this patch papers over it.

Reported-by: default avatar <syzbot+4a75454b9ca2777f35c7@syzkaller.appspotmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 842317de

sound/core/seq/seq_clientmgr.c

+1 −2
Original line number Diff line number Diff line
@@ -1818,8 +1818,7 @@ static int snd_seq_ioctl_get_client_pool(struct snd_seq_client *client, 
	if (cptr->type == USER_CLIENT) {

		info->input_pool = cptr->data.user.fifo_pool_size;

		info->input_free = info->input_pool;

		if (cptr->data.user.fifo)

			info->input_free = snd_seq_unused_cells(cptr->data.user.fifo->pool);

		info->input_free = snd_seq_fifo_unused_cells(cptr->data.user.fifo);

	} else {

		info->input_pool = 0;

		info->input_free = 0;

sound/core/seq/seq_fifo.c

+17 −0
Original line number Diff line number Diff line
@@ -280,3 +280,20 @@ int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize) 


	return 0;

}



/* get the number of unused cells safely */

int snd_seq_fifo_unused_cells(struct snd_seq_fifo *f)

{

	unsigned long flags;

	int cells;



	if (!f)

		return 0;



	snd_use_lock_use(&f->use_lock);

	spin_lock_irqsave(&f->lock, flags);

	cells = snd_seq_unused_cells(f->pool);

	spin_unlock_irqrestore(&f->lock, flags);

	snd_use_lock_free(&f->use_lock);

	return cells;

}

sound/core/seq/seq_fifo.h

+2 −0
Original line number Diff line number Diff line
@@ -68,5 +68,7 @@ int snd_seq_fifo_poll_wait(struct snd_seq_fifo *f, struct file *file, poll_table 
/* resize pool in fifo */

int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize);



/* get the number of unused cells safely */

int snd_seq_fifo_unused_cells(struct snd_seq_fifo *f);



#endif